TSMC Employee Data Leak: Hackers Demand 3 Bitcoin as 46000 Records Surface

TSMC (2330.TW) confirmed on Thursday that a trove of current and former employee records had been posted without authorization on an external website, after hackers claimed to hold roughly 46,000 employee files and put a 3-bitcoin price tag on keeping them private.

The world's largest contract chipmaker said it had found no sign that its own systems were breached. Instead, the data "has been verified to match data stored in the system services of a cloud service provider," the company said in a statement, adding that the material is unrelated to its manufacturing operations or customer information.

The disclosure came after sellers on underground forums including DarkForums and BreachForums advertised a 6.9GB dataset they said contained 46,000 employee records. The asking price of 3 BTC works out to roughly $214,923 at a bitcoin price of $71,641. The sellers threatened to publish the full archive if no buyer stepped forward within a week.

To back up their claim, the hackers released a sample file named "tsmc.txt" said to contain 499 records across 19 fields each, covering names, dates of birth, job titles, nationalities, national ID numbers, addresses, mobile numbers, email addresses and bank details. The sample may also include emergency information, which would extend any exposure beyond employees themselves.

The 46,000-record and 6.9GB figures remain the sellers' assertions; TSMC has not confirmed how many people were affected or which fields were compromised. The company said it has begun notifying impacted personnel and is providing support, and that it is working with the cloud vendor, investigating authorities and a third-party cybersecurity firm to establish what happened.

TSMC shares fell 1.55% on Thursday. The stock is down 1.25% on the session in recent trading.

Why the leak is unlikely to hit the core business

The distinction TSMC drew between its internal network and the third-party cloud environment matters for investors. Because the company says its own systems were untouched, there is no indication that process technology, customer orders or trade secrets were exposed. TSMC is the industry's most advanced foundry, producing chips on its 2-nanometer node and leading in advanced packaging such as CoWoS, making its manufacturing know-how among the most valuable corporate secrets in the world.

Sell-side sentiment has not shifted on the news. The consensus rating on TSMC among analysts covering the stock is Strong Buy, based on nine Buy ratings over the past three months, with an average price target of $563.75, implying roughly 38.4% upside from current levels. No analyst has revised estimates in response to the breach.

Note: Record counts and data volume are the sellers' claims and have not been confirmed by TSMC.

A repeat of a familiar pattern for the supply chain

This is not the first time TSMC has been drawn into a breach originating outside its own walls. In 2023, a hardware supplier, Kinmax Technology, was hit by the LockBit ransomware group, which leaked information related to server configuration and demanded $70 million. TSMC said at the time that the incident did not affect operations or customer data. The two episodes differ in the type of data involved and in how they occurred, but both point to the same weak link: third-party vendors that hold or process company information.

The current case also raises questions that remain unanswered. TSMC has not identified the cloud provider involved, has not confirmed the number of affected individuals, and has not established how the data left the vendor's environment. The company's statement that the leaked material matches data held by a cloud provider is not the same as confirming that the provider was itself hacked, and the actual cause will require forensic investigation.

For the broader semiconductor industry, the episode underscores how far security perimeters now extend. As chipmakers spread manufacturing and administrative operations across global sites and hand functions such as human resources and administration to outside cloud vendors, protecting internal networks is no longer sufficient. Data governance has to reach into the access controls, storage practices and incident-reporting arrangements of every outside service provider.

The risk to individuals is separate from the risk to the business. Even without process technology or customer data, a cache of names, job titles, details and bank information can be used for identity theft, phishing and targeted social engineering. TSMC's prominence in the global supply chain could make its staff easier to single out, with attackers able to pose as colleagues, partners or recruiters. No evidence has emerged that such follow-on attacks have occurred.

TSMC has flagged artificial intelligence as a growing security concern in its own disclosures, noting that attackers may use AI to develop malicious code and more convincing phishing campaigns, and that even extensive network defenses cannot guarantee protection against increasingly sophisticated threats. The company says it continues to strengthen application security, automated data-center scanning, privileged account management and protection of critical data, and is deploying AI to speed detection and response across its global sites and cloud platforms.